CVE-2025-40602
Description
CVE-2025-40602 is a privilege escalation vulnerability in SonicWall SMA1000 appliances. Active exploitation reported; update firmware immediately.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| sma6200_firmware | * | 12.4.3-03245 | vulnerable |
| sma6200_firmware | 12.5.0 | 12.5.0-02283 | vulnerable |
| sma6200 | - | - | unaffected |
| sma6210_firmware | * | 12.4.3-03245 | vulnerable |
| sma6210_firmware | 12.5.0 | 12.5.0-02283 | vulnerable |
| sma6210 | - | - | unaffected |
| sma7200_firmware | * | 12.4.3-03245 | vulnerable |
| sma7200_firmware | 12.5.0 | 12.5.0-02283 | vulnerable |
| sma7200 | - | - | unaffected |
| sma7210_firmware | * | 12.4.3-03245 | vulnerable |
| sma7210_firmware | 12.5.0 | 12.5.0-02283 | vulnerable |
| sma7210 | - | - | unaffected |
| sma8200v | * | 12.4.3-03245 | vulnerable |
| sma8200v | 12.5.0 | 12.5.0-02283 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Immediately download and install the security patches provided by SonicWall for the SMA1000 series as detailed in security advisory SNWLID-2025-0019.
Update affected systems
Ensure all SMA6200, SMA6210, SMA7200, SMA7210, and SMA8200v appliances are running firmware versions 12.4.3-03245 or 12.5.0-02283 or later.
Restrict access
Isolate the Appliance Management Console (AMC) from the public internet and restrict access to authorized administrative subnets using strict firewall rules and ACLs.
Monitor for exploitation
Review appliance audit logs for unauthorized configuration changes, unexpected privilege elevation events, or administrative sessions originating from unfamiliar internal IP addresses.
Detection Guidance
Detecting exploitation of CVE-2025-40602 requires monitoring SonicWall AMC logs for unusual administrative behavior. Watch for log entries indicating failed authorization attempts followed by successful high-privilege actions. Security teams should also inspect system logs for any unauthorized shell access or modifications to system-level configuration files. Since this involves privilege escalation, focus on identifying accounts that suddenly exhibit root-level capabilities or perform sensitive operations outside of scheduled maintenance windows.